2026-10-14 · 7 min read
- cookies
- privacy
- embeds
Third-party cookies were a single jar: a cookie set for an embedded host was sent to that host no matter which site framed it. CHIPS changes the jar. A cookie marked Partitioned is keyed by the top-level site as well as by the host that set it.
That is the right storage for an embed that needs its own session per customer site. It is the wrong storage for a cookie you expect to follow the user across every site on the internet.
Set the attributes together
For a cookie that must be sent on a cross-site iframe request, send Secure, SameSite=None, and Partitioned. Browsers reject Partitioned without Secure. SameSite=None is what allows the cross-site request to carry the cookie at all. Path and Domain still apply inside the partition.
A __Host- prefix still requires Secure, Path=/, and no Domain attribute. Partitioned does not relax those rules. Prefer __Host- when the cookie is a session identifier and you can set it without a Domain attribute.
- Name the top-level site in the design note.
- Mark the cookie Secure.
- Use SameSite=None only for the cross-site embed case.
- Add Partitioned so the jar does not leak across embedders.
Test two top-level sites
Load the iframe under https://a.example and under https://b.example. Sign in under the first. The second must not receive that cookie. Then load the iframe as a top-level document on its own host and decide, deliberately, whether that unpartitioned or differently partitioned visit should see a session.
Include an http top-level page if you still have one. The partition key is schemeful. https and http do not share a partition. A redirect from one to the other looks like a lost cookie.
Keep first-party sessions on their own cookie
Your marketing site and your embedded widget do not have to share a cookie name. A first-party session set on a top-level navigation should stay unpartitioned. An embed session should be Partitioned. Sharing one name for both makes every OAuth hop and every preview hostname a debugging incident.
Document the maximum lifetime. Partitioned cookies are still cookies: Secure, expiry, and rotation rules apply. Do not store a long-lived refresh token in a cookie that JavaScript can read.
Write a redacted trace
For each test, store the top-level origin, the iframe origin, the attribute list with the value removed, and whether the next request carried the cookie. Diff the working trace and the failing trace. The difference should be the partition key or a missing attribute, not a theory about the browser.
Use Flashman's URL tool to separate the top-level site from the iframe URL, the JSON formatter for the redacted trace, diff for the two traces, and the regex tester to confirm Partitioned and SameSite appear in the header you think you sent.